Privacy Policy: Water Flow 3D: Pipe Puzzle

Version 2, effective from 15 October 2026

Privacy Policy for WaterFlow

Last updated: October 15, 2026

This Privacy Policy explains how personal data is processed in connection with the mobile application WaterFlow (referred to as the "App" or "Game").

1. Data Controller

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation applicable in the European Economic Area (EEA), the United Kingdom, and Switzerland is:

Xinger Solutions GmbH
Seefeldgasse 5
3462 Absdorf, Austria
(Registered office: Wirtschaftspark 8, 3462 Absdorf)

2. Our Approach to Privacy and Data Protection

WaterFlow is a 3D puzzle and brain game designed for a relaxing, accessible, and privacy-conscious gaming experience:

  • No User Account / No Registration: You do not need to, and cannot, create a user account in the App. There is no login, registration, or profile creation.
  • No Developer Game Servers: We do not operate our own database servers for the App and do not host or store your personal information on our own infrastructure.
  • No Third-Party Analytics or Crash Reporters: We do not embed external analytics tools (such as Google Analytics, Firebase Analytics, or Unity Analytics) or third-party crash reporting SDKs into the App.
  • Strict Data Minimization: During standard gameplay, we do not directly collect any identifying personal information (such as your real name, physical address, or payment details).

Personal data (specifically technical device identifiers, IP addresses, and mobile advertising IDs) is processed to the extent technically necessary primarily by our integrated advertising partners (AppLovin MAX, Google AdMob, and Liftoff) and by the app store operators (Apple App Store and Google Play Store).

3. Data Stored Locally on Your Device

All data required for the operation of the Game is stored exclusively locally on your device's internal storage (e.g., using Unity PlayerPrefs and local data files). This includes:

  • Your current level progress (completed levels, unlocked level packs in 4×4, 5×5, 6×6);
  • Your current balance of virtual in-game coins ("Coins");
  • Unlocked water styles and designs (e.g., Lava, Galaxy, Rainbow);
  • Gameplay statistics and local preferences (sound, music, haptic vibration);
  • Ad-pacing counters (e.g., levels completed since the last interstitial ad was shown);
  • Your local privacy and consent choices (geographic categorization and CMP consent status);
  • A local transaction ledger of already-credited in-app purchases to prevent double redemption.

Important Note: This data remains strictly on your device and is never transmitted to our servers. Because there is no cloud account, we cannot restore lost game saves, level progress, or locally consumed coins if you switch devices, uninstall the app, or clear app data without an operating system-level backup. If you use your operating system's native cloud backup service (e.g., Apple iCloud Backup or Google Backup), your device data is backed up according to the respective provider's terms and privacy policies.

  • Legal Basis (EEA/UK/Switzerland): The local storage and retrieval of this data is strictly necessary to provide the features and functions of the Game requested by you (Art. 6(1)(b) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021 / Section 25(2)(2) of the German TDDDG).

4. Download and Installation via App Stores

WaterFlow is distributed through the Google Play Store (operated by Google Ireland Limited / Google LLC) and the Apple App Store (operated by Apple Distribution International Ltd. / Apple Inc.).

When downloading, installing, or updating the App, the store operators collect and process data (such as your store account, device identifiers, installation timestamps, and payment credentials) under their own independent responsibility. We have no influence over this processing. Please review the privacy policies of the respective stores:

The store operators provide us with aggregated, anonymized statistics via their developer portals (such as download volumes per country, device models, and crash rates), which do not allow us to identify any individual user.

5. Advertising and Ad Networks

WaterFlow is free to play and is funded through advertising and optional in-app purchases. The Game incorporates the following ad formats:

  • Banner Ads: Displayed at the bottom of the screen.
  • Full-Screen Interstitials: Occasional full-screen ads that appear exclusively at natural breaks in gameplay (after completing a campaign level) and only after multiple completed levels.
  • Voluntary Rewarded Videos: Optional full-screen video ads that you can choose to watch in exchange for in-game rewards, such as free coins, hints, or level skips.

5.1 Advertising Partners and Mediation

We utilize the AppLovin MAX mediation platform along with integrated ad network demand partners to serve ads:

  1. AppLovin MAX (Mediation Platform & Ad Network):
    AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA.
    Privacy Policy: https://www.applovin.com/privacy/
  2. Google AdMob (Ad Network):
    Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EEA, UK, and Switzerland) or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (for users elsewhere).
    Privacy Policy: https://policies.google.com/privacy
    Partner Information: https://policies.google.com/technologies/partner-sites
  3. Liftoff / Vungle (Ad Network):
    Liftoff Mobile, Inc., 555 Bryant St. #520, Palo Alto, CA 94301, USA / Liftoff EMEA Ltd., 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.
    Privacy Policy: https://liftoff.io/privacy-policy/

Under this mediation structure, AppLovin MAX requests bids in real time from advertising networks (including Google AdMob and Liftoff). The partner offering the most relevant ad or the highest bid is selected to deliver the advertisement to your device.

5.2 Categories of Data Processed by Ad Partners

The integrated advertising SDKs automatically collect and process certain technical information, including:

  • Mobile Advertising Identifiers: Google Advertising ID (GAID) on Android, Identifier for Advertisers (IDFA) on iOS (only if tracking permission has been granted via Apple's App Tracking Transparency prompt), or Identifier for Vendors (IDFV);
  • Device and System Information: Device manufacturer and model, operating system and version, system language, screen resolution, time zone, mobile carrier, battery level, storage space;
  • Network and Connection Data: IP address (used for network routing, general location estimation at country/city level, and fraud detection), connection type (Wi-Fi, cellular);
  • Ad Interaction Data: App bundle identifier, session duration, ads requested, ads viewed, click events, video playback completion, and technical error logs;
  • Consent and Privacy Status: IAB TCF consent string, CMP user selection flags, and age gate indicators.

We do not receive or store this advertising data on our own systems, nor do we combine it with your identity.

5.3 Purposes of Processing

Our advertising partners process this data for the following purposes:

  • Technical delivery and display of advertisements;
  • Accounting and billing for impressions and clicks between us, mediation partners, and ad networks;
  • Frequency capping to prevent the same advertisement from being displayed repeatedly;
  • Fraud and abuse detection (filtering bot traffic, invalid clicks, and malicious software);
  • Measuring ad performance and engagement;
  • Only with your explicit consent: Delivering personalized advertisements tailored to your interests and previous app activity across other apps.
  • Personalized Advertising & Access to Device Identifiers: The legal basis is your voluntary and explicit consent pursuant to Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive (in Austria Section 165(3) TKG 2021; in Germany Section 25(1) TDDDG; in the UK the Privacy and Electronic Communications Regulations).
  • Non-Personalized Ads, Fraud Prevention & Billing: Where consent has not been granted or has been withdrawn, no personalized ads are served. In this case, contextual, non-personalized ads are shown. The processing necessary for ad delivery, security, fraud prevention, frequency capping, and billing is based on our legitimate interest in monetizing and maintaining the free-to-play Game (Art. 6(1)(f) GDPR).

You maintain complete control over your privacy choices and can change or revoke your consent at any time with effect for the future:

  1. In-App Privacy Settings:
    Open the Game, tap the gear icon (Settings) on the main menu, and select "Privacy Settings". This reopens the Consent Management Platform (Google UMP / AppLovin CMP), where you can review, adjust, or withdraw your consent.
  2. iOS Device Settings (iPhone / iPad):
    Navigate to Settings > Privacy & Security > Tracking to review or disable tracking permissions for WaterFlow at any time.
  3. Android Device Settings:
    Navigate to Settings > Google > Ads (or Settings > Privacy > Ads) to reset or permanently delete your Google Advertising ID.
  4. Industry-Wide Opt-Out Tools:
    You may also opt out of interest-based advertising by participating ad networks via industry self-regulation programs:

5.6 "Remove Ads" Purchase

If you purchase the optional "Remove Ads" (removeads) in-app purchase, all banner ads and automatic interstitial ads are permanently removed.

Please note: Voluntary rewarded video ads remain available in the game so you can still choose to watch videos in exchange for free in-game coins. As a result, the advertising SDK remains present in the App, but it will only initiate ad requests when you deliberately tap a rewarded ad button.

6. In-App Purchases and Billing

WaterFlow offers optional virtual items:

  • Consumable coin packs (coinpack1 through coinpack4) used for hints, undo moves, level skipping, and cosmetic water styles;
  • The non-consumable, one-time purchase "Remove Ads" (removeads).

6.1 Payment Processing via App Stores

All purchases are processed directly by Apple (Apple App Store) or Google (Google Play Store) using the payment details associated with your store account. We never receive, process, or store your credit card, bank details, or billing address.

6.2 Purchase Verification (Unity In-App Purchasing)

To verify purchases and unlock digital items reliably on your device, the App uses the Unity In-App Purchasing library provided by Unity Technologies (Unity Technologies SF, 30 3rd Street, San Francisco, CA 94103, USA / Unity Technologies ApS, Niels Hemmingsens Gade 24, 1153 Copenhagen, Denmark; Privacy Policy: https://unity.com/legal/privacy-policy).

The library receives a digitally signed purchase receipt from the app store (containing the product ID, transaction ID, timestamp, and purchase token), verifies its integrity, and credits the item to your local game balance.

  • Legal Basis: Performance of a contract regarding the purchase and delivery of the digital content (Art. 6(1)(b) GDPR).

The Game includes buttons that open external content in your standard web browser or system apps:

  • Privacy Policy & Imprint: Opens web pages (https://x4apps.com/waterflow/privacy and https://x4apps.com/imprint). When you access these pages, the hosting web server processes standard access logs (such as visited URL, timestamp, browser user-agent, and IP address) to deliver the website securely (Legal Basis: Art. 6(1)(f) GDPR).
  • Rate Us: Directs you to the WaterFlow store listing on Google Play or the Apple App Store.
  • Share: Opens the native OS sharing dialog. We do not track or receive any data regarding who you share the link with.

8. Customer Support via Email

If you reach out to us by email (e.g., at office@xinger.org), we process your email address, your name (if provided), and the content of your message, including any technical details you submit, in order to assist you with your inquiry.

  • Legal Bases: Handling your support request or pre-contractual inquiry (Art. 6(1)(b) GDPR) and our legitimate interest in providing reliable customer support (Art. 6(1)(f) GDPR).
  • Retention: Support correspondence is deleted once your request has been resolved, unless statutory record-keeping obligations (e.g., 7 years under Austrian tax and commercial law pursuant to Section 212 UGB / Section 132 BAO) require longer retention.

9. International Data Transfers

Some of our third-party service providers (specifically AppLovin Corporation, Google LLC, Liftoff Mobile, Inc., and Unity Technologies) are based in the United States or process data on servers located outside the EEA.

Data transfers to the United States are governed by:

  1. EU–U.S. Data Privacy Framework (DPF): Where recipients are certified under the DPF, transfers are based on the European Commission's adequacy decision pursuant to Art. 45 GDPR (and the corresponding UK Extension and Swiss-U.S. DPF). Google, AppLovin, and Liftoff participate in or adhere to the relevant DPF frameworks.
  2. Standard Contractual Clauses (SCCs): Where applicable or as a supplementary safeguard, data transfers are secured by the European Commission's approved Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, combined with supplementary technical and organizational security measures.

10. Data Retention

  • Local Gameplay Data: Remains stored on your device until you delete the Game or clear app storage.
  • Data Held by Ad Partners and Stores: Stored in accordance with their respective privacy policies (typically ranging from a few days for raw server logs to 24–36 months for aggregated performance and financial reporting).
  • Support Records: Deleted after the inquiry is concluded, subject to statutory retention periods.

11. Children's Privacy (COPPA / Age Restrictions)

WaterFlow is intended for a general audience aged 13 and older.

  • The Game is not directed at children under 13 (or the age required by local law for independent digital consent, e.g., up to 16 in certain EU member states).
  • We do not knowingly collect personal information from children under 13.
  • In GDPR jurisdictions, the integrated consent mechanism prevents the delivery of personalized ads to underage players without parental consent.
  • If you are a parent or legal guardian and believe that your child under 13 has provided personal data to us or our advertising partners without your consent, please contact us at office@xinger.org. We will promptly take steps to delete any such data.

12. Your Rights Under GDPR, UK GDPR, and Swiss Law

If you reside in the EEA, the United Kingdom, or Switzerland, you have the following statutory rights under applicable data protection laws:

  • Right of Access (Art. 15 GDPR): Obtain confirmation and information regarding the personal data processed about you.
  • Right to Rectification (Art. 16 GDPR): Correct inaccurate or incomplete personal data.
  • Right to Erasure (Art. 17 GDPR): Request the deletion of your personal data ("right to be forgotten").
  • Right to Restriction of Processing (Art. 18 GDPR): Restrict the processing of your data under certain conditions.
  • Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21 GDPR): Object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f) GDPR).
  • Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw any consent granted for personalized advertising at any time with future effect via the in-app "Privacy Settings" or your device settings.

Note on Identification (Art. 11 GDPR): Because we do not operate remote user accounts and do not store direct identifiers, we cannot identify your device or advertising records without your assistance (e.g., providing your device advertising ID). You may also exercise your rights directly with AppLovin, Google, or Liftoff; we are happy to assist you with any request.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority. Our lead supervisory authority in Austria is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

In the United Kingdom, you may lodge a complaint with the Information Commissioner’s Office (ICO) (ico.org.uk). In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) (edoeb.admin.ch).

13. State-Specific Information for United States Residents

This section supplements our Privacy Policy for users residing in US states with comprehensive privacy legislation, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other applicable states.

13.1 Notice at Collection

In the preceding 12 months, our third-party advertising partners may have collected the following categories of personal information for business and commercial purposes:

  • Identifiers: Mobile advertising IDs (Google Ad ID, IDFA), IP address, unique device identifiers;
  • Internet or Electronic Network Activity: Ad interactions, impressions, clicks, session length, and app performance metrics;
  • Geolocation Data: Approximate geographic location derived from IP address (country and city level, not precise GPS);
  • Inferences: Profile inferences regarding interests and ad categories where tracking consent has been granted.

13.2 Sale and Sharing of Personal Information

We do not sell your personal information for monetary compensation.

However, under the broad statutory definitions of the CCPA/CPRA and related state statutes, making online identifiers available to advertising networks for cross-context behavioral advertising or targeted advertising may constitute a "Sale" or "Sharing" of personal information.

13.3 Your Rights Under US State Laws

  • Right to Opt-Out of Sale and Sharing / Targeted Advertising: You have the right to direct us not to sell or share your personal information for targeted advertising ("Do Not Sell or Share My Personal Information"). You can exercise this right at any time by:
    • Tapping "Privacy Settings" in the Game's Settings menu to reject personalized advertising;
    • Disabling or deleting your advertising identifier in your Android device settings or declining tracking on iOS;
    • Emailing us at office@xinger.org.
  • Right to Know and Access: You may request details about the categories and specific pieces of personal information collected.
  • Right to Delete and Correct: You may request the deletion or correction of your personal data.
  • Non-Discrimination: We will not discriminate against you (in pricing, features, or game quality) for exercising your privacy rights.
  • Sensitive Personal Information: We do not collect, process, or disclose sensitive personal information as defined by California law.

14. International Users (Brazil, Canada, Australia, Asia)

  • Brazil (LGPD): Brazilian users hold rights to confirmation, access, correction, anonymization, deletion, and consent revocation. Please contact office@xinger.org.
  • Canada (PIPEDA): We adhere to fair information principles regarding consent, purpose specification, and access.
  • Australia (Privacy Act 1988): We manage personal information in compliance with the Australian Privacy Principles (APPs).

15. Automated Decision-Making

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Game features, advertising integrations, or legal obligations.

The most recent version is always available within the App's settings menu and at https://x4apps.com/waterflow/privacy. If we make material changes, we will provide appropriate notice within the App.

17. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Xinger Solutions GmbH
Seefeldgasse 5
3462 Absdorf, Austria
(Registered office: Wirtschaftspark 8, 3462 Absdorf)
Email: office@xinger.org
Phone: +43 676 83924444